Oracle Security Blog

Oracle has released the Critical Patch Update (CPU) for October 2006. 101 new vulnerabilities across all Oracle products are fixed in this CPU of which 45 are remotely exploitable. The overall number is high as compared to previous CPUs, but includes a similar number of database and application server vulnerabilities. The spike is due to 35 vulnerabilities in Oracle Application Express (formerly HTMLDB).

Oracle has finally certified the use of Advanced Security Option/Advanced Network Option for encryption of SQL*Net traffic between the database and application servers. This certification had been promised for several years.

The Advanced Security Option (ASO) is an optional component of the Oracle Database and is an extra cost. Advanced Networking Option (ANO) is the previous name of ASO in Oracle 8.0.x, which is also utilized in an Oracle Applications 11i configuration since Forms, Reports, and Concurrent Manager still use an 8.0.6.3 ORACLE_HOME.

As I have previously discussed (here and here), Oracle is requiring recent ATG rollup patches to be installed as prerequisites for the Critical Patch Updates. The ATG_PF rollups are generally released every 6 months. For ATG_PF.H the following rollups have been released --

Oracle is now pushing all 11.5.10 implementations even harder in terms of mandating minimum patch levels. The October 2006 Critical Patch Update (CPU) will require at least ATG_PF.H.RUP3 and ATG_PF.H.RUP4 is recommended. These patches are not included in the base for any 11.5.10 release including CU2. 11.5.7, 11.5.8, and 11.5.9 customers must be at the minimum baseline in

The Federal Information Security Management Act (FISMA) of 2002 requires all government agencies to submit to the Office of Management and Budget an annual evaluation of IT security across the agency. The overall results of these reports are complied and reported in the annual "Federal Computer Security Report Card", which scored the Federal government a D+.

Oracle has updated the Oracle Applications 11i DMZ Configuration document (Metalink Note ID 287176.1). "Oracle E-Business Suite 11i Configuration in a DMZ" is the definitive reference for implementing Oracle Applications in a DMZ that is externally accessible. All the recommendations in this document should be closely followed and appropriately penetration tested prior to implementation. We often find significant security issues in implementatio

There was very little press coverage regarding Oracle security from last week's Black Hat security conference in Las Vegas. I am a little surprised about the lack of attention in the media regarding Pete Finnigan's presentation on unwrapping PL/SQL code.

You may want to warn your CIO and IT Security Manager that some bad press about Oracle security will be coming later this week and next week. The annual Black Hat conference in Las Vegas is Wednesday and Thursday of this week. Every year this conference gets significant media exposure -- last year was the controversy regarding Cisco and Michael Lynn. There doesn't seem to be any major headlines this year, so the press may be digging for stories.

There are currently three major un-patched and published Oracle Database security bugs and all three bugs impact the Oracle E-Business Suite. All Oracle Applications 11i implementations should review the possible impact on their installations to determine the necessary corrective action. I don't foresee any of these bugs being fixed before the October 2005 Critical Patch Update.

We have released our E-Business Technology Stack Support Matrix for the Oracle Critical Patch Update (CPU) July 2006. The supported technology stack versions required by Oracle’s
Critical Patch Updates (CPU) may be different from the certified technology
stack versions. A prime example is that 9.2.0.5 is certified for Oracle Applications, but is not supported by the July 2006 CPU. The Technology Stack support matrix highlights the differences between certified versions and CPU July
2006 required versions.

Google is such a powerful tool and people are finding new ways to exploit its capabilities. The newest use is to find security bugs in open source code, since much of this code is published in code repositories indexed by Google. Google searches can look for specific file extensions (like c, pls, sql, or ora).

Oracle has decided not to release any security fixes in the July 2006 Critical Patch Update for Oracle E-Business Suite releases 11.5.1 - 11.5.6. This may come as a shock to more than a few customers since the official Desupport date for 11.5.1 to 11.5.6 is July 31, 2006 (not July 18, 2006).

A frequent topic of discussion after any security assessment or review by auditors is the setting of O7_DICTIONARY_ACCESSIBILITY in Oracle Applications. 07_DICTIONARY_ACCESSIBILITY is a database initialization parameter that controls access to objects in the SYS schema. It was originally intended to help with migrations from Oracle7 to newer versions where access to data dictionary objects is limited by default. From a pure security perspective, 07_DICTIONARY_ACCESSIBILITY should always be set to FALSE and is a very common security recommendations for Oracle Databases in general.